urelas | 862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe
Size

192KB
MD5

5d3781d01a072727ceaf41e54b6faad2
SHA1

c8ab2f99c7562ec176511a6f80c8cfcfbb0de277
SHA256

862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c
SHA512

7931adcdb59bb758b4d1a53f660bc4a1495a4a3bd454ef22d651ac7405bb25df3cadca22f27fb39c43e9606a0b6364cd761cd524a4389a55f0dfd3b84c0c51d6
SSDEEP

3072:gAwixCZ6Sh77R2Gpf606U8v0e7OIgPDFIbbzhPM67fIhO:gExhk7rh7NEOIYWlPM6r6O

Score

10^/10

urelas discovery trojan

Malware Config

Extracted

Family

urelas

218.54.47.76

218.54.47.77

218.54.47.74

Signatures

Urelas
Urelas is a trojan targeting card games.
trojan urelas
Urelas family
urelas

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe

Executes dropped EXE 1 IoCs

Processes:

biudfw.exe

pid	Process
1100	biudfw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exebiudfw.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biudfw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe

description	pid	Process	procid_target
PID 1508 wrote to memory of 1100	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	83
PID 1508 wrote to memory of 1100	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	83
PID 1508 wrote to memory of 1100	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	83
PID 1508 wrote to memory of 4712	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	84
PID 1508 wrote to memory of 4712	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	84
PID 1508 wrote to memory of 4712	1508	862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe	84

C:\Users\Admin\AppData\Local\Temp\862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe
"C:\Users\Admin\AppData\Local\Temp\862a38f6e34687da7183713e8246e8c3d7b4d6eca9fafb36da705683b14ef60c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\biudfw.exe
  "C:\Users\Admin\AppData\Local\Temp\biudfw.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biudfw.exe

Filesize
192KB

MD5
2559f0cc17631851e6165afd07b76556

SHA1
af7e41555c0d9c2aa127da4245cfc6645a37445a

SHA256
0e037e00eab3a72b51d6ba2932fdf8986c4598d577ef3645d0384423990fbfd6

SHA512
c0b8a2cabcd4196a2a0041e019d365e93915ffed30a9a9e0efd8fdfa624af447b9352544f94ecbc44a44806e697c9d6051535b73dea7eadafaf02ffb42475f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\golfinfo.ini

Filesize
512B

MD5
2776cde4761cefd1198f4712989957b1

SHA1
c801245a080524e704e8e3da95700e58e9d1ca3c

SHA256
69ca5964abf7f1c054541bcc32f2712d3fa51342913affed5023825e3dca521f

SHA512
bdc242f5c69d10cbfa903bbf20448a9e93213ee303091f1ae9ff8d29c83250168491d9b553841f8ed9b756aef29c499eea3562ff9f94b5619012eb21d5d88c4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sanfdr.bat

Filesize
338B

MD5
c72b0dbc2accb020ba8189860fcf2362

SHA1
5a1f10a1829006cdc073619262ccc504524f39ee

SHA256
87760fd1e929aac24d76876d4066670b956112e180a46f9e4bf4ea2a3edd4c03

SHA512
4e77fe1c41c63f154387004a39a120f6c420917ccf6df478bd9c30918ed59f7ae17a2b10fbd7d90511e8e0d69b04f561bb7e5c50f5b3f28bbb46a309097b5990

Download Submit
memory/1100-12-0x0000000000A30000-0x0000000000A64000-memory.dmp

Filesize
208KB

Download
memory/1100-17-0x0000000000A30000-0x0000000000A64000-memory.dmp

Filesize
208KB

Download
memory/1100-18-0x0000000000A30000-0x0000000000A64000-memory.dmp

Filesize
208KB

Download
memory/1508-0-0x0000000000CC0000-0x0000000000CF4000-memory.dmp

Filesize
208KB

Download
memory/1508-14-0x0000000000CC0000-0x0000000000CF4000-memory.dmp

Filesize
208KB

Download